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DETAILED ACTION 
Response to Amendment 

1 . Applicant's request for reconsideration of the finality of the rejection of the 
last Office action is persuasive and, therefore, the finality of that action is 
withdrawn. 

2. Claims 1 , 2, 4-6, 8-1 2, 1 4-20, 22, 24-28, 30-34, 36 and 37 are pending 
and have been examined. 

EXAMINER'S AMENDMENT 

3. An examiner's amendment to the record appears below. Should the 
changes and/or additions be unacceptable to applicant, an amendment may be 
filed as provided by 37 CFR 1 .312. To ensure consideration of such an 
amendment, it MUST be submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone 
interview with Bryan Kirkpatrick on 1 -4-201 1 

The application has been amended as follows: 
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IN THE CLAIMS : 

Please amend claims 11,12 and 31 as shown below: 

1 1 . An apparatus comprising a storage device for storing computer files, 
wherein the apparatus is configured to: 

obtain a steganographic signature by reading a partial section of 
executable code of a program, wherein the program includes software calls that 
introduce steganographic items into a computer file; 

identify one or more computer files, other than the program, comprising 
software code; obtain one or more test signatures by reading partial sections of 
the software code; 

compare the steganographic signature with the one or more test 
signatures to identify when a match with the steganographic signature is found; 
and 

in response to identifying when the match is found, i nd i cato display a 
listing of which of the one or more computer files has been modified by the 
program. 



1 2. The apparatus according to claim 1 1 , wherein the i nd i cat i on listing 
incorporates an identification of the steganographic signature. 
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31 . A non-transitory computer readable medium having stored therein 
computer readable instructions that, in response to execution by a system, cause 
the system to perform operations comprising: 

identifying one or more computer files comprising software code; 

obtaining one or more test signatures by reading partial sections of the 
software code; 

obtaining a steganographic signature by reading executable code 
comprising part of a steganographic program including software calls that 
introduce steganographic items into the one or more computer files; 

comparing the steganographic signature with the one or more test 
signatures, wherein the steganographic program is excluded from said 
comparing; and 

in response to said comparing, i dont i fy i ng displaying a listing of which of 
the one or more computer files comprises software code that has been modified 
by the steganographic program. 
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Allowable Subject Matter 

4. Claims 1 , 2, 4-6, 8-1 2, 1 4-20, 22, 24-28, 30-34, 36 and 37 are allowed. 

5. The following is an examiner's statement of reasons for allowance: 

The closest prior art in the field does not teach the combination of features 
of the claimed invention, particularly including the Applicant's steps of identifying 
files that have been modified by the introduction of steganographic items by a 
steganographic program, where the identification is accomplished by obtaining 
steganographic signatures of partial segments of the software code and 
comparison with test signatures, all in the manner of the Applicant as set forth in 
his disclosure. 

Any comments considered necessary by applicant must be submitted no 
later than the payment of the issue fee and, to avoid processing delays, should 
preferably accompany the issue fee. Such submissions should be clearly labeled 
"Comments on Statement of Reasons for Allowance." 

Conclusion 

6. Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Paul E. Callahan whose telephone number is 
(571) 272-3869. The examiner can normally be reached on M-F from 9 to 5. 

If attempts to reach the examiner by telephone are unsuccessful, the 
Examiner's supervisor, Eleni Shiferaw, can be reached on (571) 272-3867. The 
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fax phone number for the organization where this application or proceeding is 
assigned is: (571) 273-8300. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 
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